Privacy policy | Lyluutravel

This privacy policy sets out how Lyluu Travel collects, uses and protects your personal data when you use the website lyluutravel.fr and the Lyluutravel mobile app (iOS and Android). It applies in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

1. Data controller

The data controller is Lyluu Travel.
Contact: contact@lyluutravel.fr

2. Data collected

We collect only the data our services need to work:

Account data: email address and password (stored encrypted) when you create an account.
Profile data: surname, first name, phone number, emergency contact (name and phone) and profile picture, if you choose to provide them.
Trip data: what you send us in your bespoke trip requests, appointment requests, bookings and exchanges with us (destinations, dates, preferences, travellers).
Payment data: payments (travel guides, services) are handled by our provider Stripe. We never store your bank details; Stripe handles them under its own privacy policy.
Push notifications (mobile app): if you accept them, a technical notification token is tied to your account so we can send you notifications about your requests and trips. You can turn them off at any time in your device settings.
Profile picture (mobile app): access to the camera or photo library is used only if you choose to add a profile picture.

We use no targeted advertising tools, and we neither sell nor rent your personal data to third parties.

3. Purposes and legal bases

Creating and managing your account, and signing you in (performance of the contract).
Handling your trip requests, appointments and bookings (performance of the contract).
Handling your purchases and their delivery (performance of the contract, legal obligations).
Answering your messages sent through the contact form (legitimate interest).
Sending you notifications about your requests (legitimate interest / consent for push notifications).
Keeping the website and the app secure and working properly (legitimate interest).

4. Recipients and processors

Your data is accessible only to Lyluu Travel and to its technical processors, who act on instruction only:

Supabase: database hosting and authentication.
Vercel: website hosting.
Stripe: payment processing.
Expo: delivery of the mobile app's push notifications.

5. How long data is kept

Your account and profile data is kept for as long as your account is active. Data about bookings and payments is kept for the legal periods that apply (accounting rules in particular). The data of a deleted account is erased or anonymised within a reasonable time, apart from what the law requires us to keep.

6. Deleting your account

You can ask for your account and the data attached to it to be deleted at any time by writing to contact@lyluutravel.fr. Deletion is carried out as quickly as we can, apart from data the law requires us to keep.

7. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, object to and port your data. To exercise those rights, contact us at contact@lyluutravel.fr. If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

8. Cookies

lyluutravel.fr uses no advertising cookies and no trackers for profiling. Only cookies strictly necessary for the site to work (session, authentication, Stripe payment) may be set; those require no prior consent.

9. Security

We put appropriate technical and organisational measures in place to protect your data: encrypted connections (HTTPS), secure password storage and restricted access to the data.

10. Changes

This policy may be updated. If we change it substantially, we will tell you through the website or the app. The date of the last update appears at the top of this page.

This English text is a translation provided for convenience. In the event of a discrepancy, the French version prevails.